The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to interpolate user-provided strings (URLs or file paths) directly into a bash script template. This pattern creates a shell injection vulnerability if the input is not sanitized, as the input is assigned to a variable that is later evaluated in the shell environment.
[EXTERNAL_DOWNLOADS]: The skill downloads content from arbitrary URLs provided by the user, specifically targeting PDF files for analysis. While intended for research papers, this mechanism can be used to pull data from any remote source.
[REMOTE_CODE_EXECUTION]: The workflow automates the installation of external software using npm install and pip install pymupdf. It also executes local Node.js scripts (e.g., download-pdf.cjs and parse-pdf.js) to perform its primary functions, which involves running code from the skill's own package directory.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes text from untrusted external PDFs.
Ingestion points: PDF content extracted via parse-pdf.js and user-supplied arXiv/web URLs.
Boundary markers: The workflow lacks explicit delimiters or instructions to the agent to treat the extracted paper text as data rather than instructions.
Capability inventory: The skill possesses Bash access for shell execution and Write access to the local file system.
Sanitization: There is no evidence of filtering or sanitizing the text extracted from papers before it is presented to the agent's context.

claude-paper-summary